Users should have to be authenticated to access the resource, not just rely on the URL being a secret.